Privacy · 20 October 2026
What We Keep
Your account: an email address. No password is stored. On the web you sign in with a link we email you (or the 6-digit code in it, when the email shows one). The iPad app, coming to the App Store, may offer Sign in with Apple; if you use it, we keep the identifier Apple gives us.
Your binder and shop: the cards, prices paid, conditions, grades, watch tags, decks, stock, sales, receipts, labels and customers you enter. A shop also keeps what its customers give it (names, emails, phone numbers for text receipts) and the buyers' names and addresses on its eBay and TCGplayer orders. Photos of your own cards go in private storage only you (and your shop's staff) can reach.
How you use it: the cards you open (for your "recent" list), the device token for push on the iPad if you turn it on, and server logs kept for 30 days to find faults.
What brought you: when you sign up, hold a card or follow a shop, we note the kind of place that sent you there, such as a search engine, Discord or a shop's QR code. Never the address of the page or what you searched for. A shop sees these notes only for its own holds and followers.
Payment: handled by Stripe. We keep your Stripe customer id and your plan; we never see your card number. When a shop takes a card at its counter, Stripe handles that payment too.
What Is Public, When You Choose
Nothing you keep is public until you make it so. You can choose to show:
- a profile at your @handle, with the showcases you pick (search engines see it only if you say they may);
- a shared binder, to anyone with its link;
- prices on either, if you turn them on.
A trade shows your handle and the cards in it to the person you are trading with. An RSVP to a shop's event tells that shop you are coming.
When you share your watchlist with a shop, it also counts toward Wanted Near You: anonymous totals on the shop directory's page for that shop's city. A city shows only once 5 or more collectors share, and a card only once 3 or more want it. It shows numbers, never a name, a binder or what you paid. You can switch it off in your binder's Settings.
Who Sees It
You, your shop's members, and the services that run Pullsheet, each for its own part:
- Supabase: the database and sign-in.
- Vercel: hosting.
- Stripe: plans, and card payments at a shop's counter.
- Resend: the emails Pullsheet sends.
- Twilio: text receipts, to the phone number a shop's customer gives.
- eBay and TCGplayer: a shop's listings go to them, and its orders come back with buyers' names and addresses.
- EasyPost: shipping labels, with the addresses on them.
- PSA: the cert numbers of graded cards, to look up the slab.
- Anthropic: a card photo you scan, to read which card it is. We don't keep the photo.
- Apple: push notifications to the iPad app.
Prices and pictures are fetched from TCGdex, TCGCSV, Scryfall, Lorcast, SWU-DB and DigimonCard.io; those requests carry card ids, not your identity. A shop on Shop Pro can send its own data to its own systems with API keys and webhooks.
How Long
While your account exists. Delete it from Settings and your binder, tags and decks go at once. We don't keep scheduled backups yet, so what is deleted is gone. The one exception is a copy we take now and then to prove the database restores; it is deleted when the test ends. A shop's sales records stay with the shop for its books until the shop is deleted.
Your Rights
Download everything (Settings → Your account), correct anything (it is all editable), delete your account. Write to hello@ninefathoms.com for anything else.
Cookies
One session cookie to keep you signed in, three preference cookies (game, mode, look), and one of our own that remembers for 30 days only the kind of place that last sent you here (a search engine, Discord, a shop's QR code), never the address. No advertising, no third-party trackers.